Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/tursodatabase/turso-cli

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5GoPublished

    turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

    CVE-2026-48790 · GHSA-57f6-pvx8-hwj6

    Affected
    • Go github.com/tursodatabase/turso-cli <= 1.0.25
    Fixed in
    1.0.26· Vendor fix available
    Issue
    turso-cli persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations. Impact The token in settings.json grants the holder full Turso platform access — create or destroy databases, rotate credentials, exfiltrate data, change billing settings — for any organization the user belongs to. Because the file is world-readable, the credential is reachable by: - Cron jobs or daemons running as a different system user on the same host - Sandboxed CI runners with a mounted home directory - Containers with a bind-mounted host home - Co-tenants on a shared multi-user developer or jumpbox host The file path resolves through configdir.LocalConfig("turso"): - macOS: ~/Library/Application Support/turso/settings.json…

    Recommended action: Upgrade to 1.0.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →